AI systems engineer & security researcher. I build and investigate the infrastructure that connects AI agents to tools and services: MCP integrations, OAuth interoperability and runtime trust boundaries. I trace a problem from the configuration and the authorization flow to the process that makes the request, then fix it upstream with regression tests. Both halves ask one question: who decided that this request was allowed?
| Project | Status | Contribution |
|---|---|---|
| Supabase | Merged, 14 October 2026 | Moved the Devin MCP preset from an unpinned mcp-remote bridge to native HTTP configuration, removed the dead bridge type, added shared setup instructions and brought Devin into the common client URL round-trip test. 4 files, +46/−38, 273 package tests. |
| homarr-labs / dashboard-icons | Merged, 19 October 2026 | Moved the MCP setup dialog's VS Code, Claude Code, Claude Desktop, Windsurf and Zed tabs from an unpinned mcp-remote bridge to native HTTP connections; the custom-client tab keeps the bridge, pinned to 0.15.1. 5 files, +119/−30, 12 Chromium dialog tests. The maintainer checked every tab and merged with a fix of his own on top. |
| homarr-labs / dashboard-icons | Merged, 20 October 2026 | Found while preparing the change above: the MCP route skipped the OAuth sign-in challenge and the per-call rate limit for legacy JSON-RPC batches. The fix reads every tools/call in a batch, challenges before dispatch and sizes the body limit by request class. 3 files, +482/−9, 1,572 tests. |
| Alibaba Cloud / iac-code | Merged, 20 October 2026 | Replaced the npx mcp-remote wrapper example in the MCP passthrough documentation with a local stdio server, in English and six locales, with a note that a remote HTTP server needs no wrapper. 15 files, +76/−72, 139 pytest checks and the docs site built for seven locales. |
| Quarkus / quarkus-agent-mcp | Merged, 21 October 2026 | Skill writes stay inside the skills directory: dot segments are rejected before any directory is created, the project and global roots are resolved and checked before writing, and SKILL.md is opened without following links. Reported privately to the Quarkus security team first, who assessed it as hardening and asked for the fix as a public pull request. 2 files, +185/−7, 482 tests including 11 boundary cases. |
| Quarkus | Merged, 21 October 2026 | The Dev UI's MCP panel generates a native context_servers URL for Zed instead of an unpinned mcp-remote bridge and drops the Node.js prerequisite from that panel. 1 file, +1/−5, milestone 4.0. The maintainer asked for a live Zed run before merging and got it in the thread. |
| rtk-ai/rtk | Merged | SHA-256 integrity verification for installed agent hooks. Operational commands refuse to run when the hook differs from its recorded baseline. Writeup and limitations. |
Verification behind the table. Supabase: Devin CLI 3000.11.3 and portable Devin Desktop 3.10.48 against a local OAuth fixture, then the hosted OAuth flow completed by the upstream reviewer. dashboard-icons: the generated configurations and the dialog's Chromium tests locally, then every client tab checked by the maintainer at two viewports before the merge; the batch fix against a loopback PocketBase fixture, with the gap first reproduced on the unmodified head. Alibaba Cloud: the documentation site built for seven locales and every snippet checked on the built pages. Quarkus: the skill-write fix against a real stdio MCP server, with the two escaping paths first reproduced on the unmodified build; Zed Stable 1.24.4 on Windows against a Quarkus 4.0.0.Beta1 dev-mode application with the configuration copied from the panel, no Authorization header, initialization and 25 tools, posted in the thread before the merge.
Earlier steps on the same line: UltraRAG #538 fixed the remote-MCP launch I reported within 27 hours and credited the report; Appwrite #14465 is open; a local patch with regression tests is ready and waits for the maintainers' go-ahead.
- Client interoperability: setup, authentication, tool discovery and reconnect behaviour tested on versioned client binaries.
- Runtime verification: HTTP requests correlated with process IDs and process trees, so the record says which component made the request.
- Reproducible fixes: source versions, traces, negative controls and regression tests preserved. Local-fixture results are kept apart from live-service validation.
Five published CVE records reference my research into mcp-remote. All five carry CISA-ADP assessments, with scores up to 9.8 Critical: CVE-2026-51994 · CVE-2026-51995 · CVE-2026-51996 · CVE-2026-51997 · CVE-2026-52001.
The research examines how remote metadata influences request destinations, browser launches and credential handling. The advisories separate local reproductions, source review and hardening findings, with version-specific scope and limitations.
Still open. On 14 October 2026 the maintainer published four releases, 0.14.4 to 0.15.1, the first since 21 September; none of them names a record. The current release, 0.15.1, was run in full against loopback canaries on 15 October 2026, with the same procedure as the 0.14.3 run of 9 October. It still follows the server-selected request path of CVE-2026-51994 and makes the authorization-server request of CVE-2026-51995, HTTP 302 redirect included; the helper functions behind all five records are byte-identical to 0.14.3. No fix has been stated since the private report of 17 February 2026. The official MCP SDKs closed this class in September 2026 (TypeScript, Python); mcp-remote 0.15.1 still bundles @modelcontextprotocol/client 2.0.0, inside the affected range.
Research and advisories · Reproduction dossier · 0.15.1 follow-up · Scope and corrections · Disclosure timeline · Impact ledger
A local coordination layer for existing AI agents operated by different people: explicit task state, scoped delegation, human approval and verifiable execution records. It carries the same question into multi-agent systems: who can authorize an agent's next action? Active engineering work.
- Five mcp-remote CVE records, five CISA scores, no stated fix · 8 October 2026, second edition
- The Signature Was Valid. The Moment Was Gone. · 23 September 2026
- Who Authorized the Swarm? · 13 September 2026
The board is re-rendered every day from the npm downloads API by a workflow in this repository. The source is one script, the data one file. No image on this page comes from a third party.
playb0t.com · @playb_0t · research repository · citation